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SUMMARY & CONCLUSIONS 

In the event of a launch vehicle failure during ascent, a 
manned space launch system requires an ascent launch abort 
system that will be able to separate the crew module from the 
launch vehicle and return the crew safely to earth. One 
measure of the effectiveness and reliability of the launch abort 
system is its ability to reduce the risk of loss of crew from the 
failure environments, such as blast overpressure and debris 
strikes from an exploding launch vehicle, resulting from the 
launch vehicle failure scenario. Physics-based models are 
used to assess the evolution of, and risks presented by, the 
failure environments. In the case of debris strikes, the 
probability of the crew module being hit by at least one piece 
of debris is computed by modeling the evolution of the debris 
field over time and determining its relative position to the 
crew module. The characteristics of the debris field, including 
the number of pieces, the mass and reference area of each 
piece, the imparted velocity magnitude and direction and the 
ballistic coefficient, are defined by a debris catalog. A model 
has been created to generate a debris catalog using a 
combination of empirical- and physics-based models. The 
debris catalog model accounts for design features of the 
launch vehicle and the failure mechanisms involved in 
determining the number of pieces and imparted velocity. The 
model results are compared with a published catalog for the 
Space Shuttle external tank. The sensitivity of the risk 
prediction to the number of pieces and the imparted velocities 
are studied. The debris catalog generation model provides an 
additional tool in the risk assessment of ascent aborts for 
manned launch systems. 

1 INTRODUCTION 

For manned space launch systems, a reliable abort system 
is required to reduce the risks associated with launch vehicle 
failures during ascent. A typical launch abort system, shown 
in Figure 1, consists of a small, powerful rocket that carries 
the crew vehicle away from the launch vehicle in the event of 
an abort (Figure 2). During ascent (Figure 2(a)), any number 
of launch vehicle failure scenarios (e.g., engine failure, 
structural failure or control failure) can lead to activation of 
the launch abort system. The launch abort system separates 
the crew module from the launch vehicle (Figure 2(b)), 


creating sufficient separation distance to avoid the failure 
environments resulting from the destruction of the launch 
vehicle (Figure 2(c)). Failure environments include any 
hazards or conditions that can harm the crew, such as blast 
overpressure and debris, and are the end results of a failure 
scenario. 



Figure 1. Launch abort system for NASA MPCV. 
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Figure 2. Ascent abort sequence with debris after launch 
vehicle destruct 


The failure scenario starts with an initiating condition 
(e.g., leaks in propellant tanks) and progresses to the failure 
mechanism that creates the failure environments. If a failure 
scenario starts with leakage and leads to propellant mixing 
within a confined space, such as the intertank region, the 
failure mechanism is a confined-by-missile (CBM) explosion. 
For a failure scenario where leakage and mixing occur in an 
open space, the failure mechanism is a deflagration, resulting 
in a weaker shock wave. Physics-based blast models [1,2] are 
used to predict the overpressure and impulse resulting from a 
CBM explosion or deflagration. Activation of the flight 


termination system (FTS) is another possible failure 
mechanism. In this case, debris is created by the linear shaped 
charge (LSC) and venting of the propellant. Failure scenarios 
involving loss of control can lead to structural failure of the 
launch vehicle due to aerodynamic loads. This failure 
scenario may not involve an explosion, but debris can be 
generated from the structural failure with velocities imparted 
by the venting propellant. All these mechanisms will cause 
the break-up of the launch vehicle, resulting in a debris field 
that poses a strike risk to the crew during an ascent abort. 

The risk of the crew being struck by at least one piece of 
debris during an ascent abort can be predicted using a physics- 
based model [3,4] that computes the trajectory of the debris 
field and tracks the relative position of the debris and the crew 
module. This model requires as input a debris catalog, which 
describes each piece of debris in terms of its mass, reference 
area, aerodynamic characteristics and additional imparted 
velocity. A debris catalog is a function of the launch vehicle 
design, construction and the failure mechanism. Catalogs for 
specific vehicles and failure mechanisms are available, such as 
one developed for the Space Shuttle flight termination system 
by Hinckley et al. [5]. The Shuttle debris catalog was 
developed using detailed knowledge of the design and 
structure and was specific to one failure mechanism 
(activation of the flight termination system). For a risk and 
reliability analysis of an ascent abort system conducted early 
in the design cycle, when one ore more preliminary designs 
are being assessed, a faster, more general approach to 
generating a debris catalog is required. The approach must 
also be able to model the impact of different failure 
mechanisms on the overall risk. To meet this need, a more 
general physics-based debris catalog model has been 
developed. 

The debris catalog model predicts the number of debris 
pieces and each debris piece mass, reference area and 
imparted velocity. The model accounts for launch vehicle 
parameters such as dry mass, propellant mass, and tank 
pressures. The imparted velocity is based on the failure 
mechanism, such as FTS activation, explosion or aerodynamic 
break-up. The following section describes the debris catalog 
model in more detail. The results of the model are used in the 
debris strike probability model, which provides an assessment 
of the risk the debris field poses to the crew module. 
Understanding the parameters that drive this risk can improve 
the safety and reliability of the launch abort system, crew 
module and launch vehicle. 

2 DEBRIS CATALOG MODEL 

The debris catalog model predicts the number of pieces, 
mass and imparted velocity of the individual pieces. The 
number of pieces and mass distribution are computed using a 
fragmentation model derived from studies on explosions. The 
imparted velocity is based on the failure mechanism involved. 
Velocities due to FTS activation are obtained from analysis of 
the propellant venting. Velocities due to explosions are 
obtained from solutions using a shock physics code. 


Fragmentation of a structure due to an explosion has been 
extensively studied. Mott and Linfoot [6] proposed an 
exponential function relating the number of fragments greater 
than a given size to the total number of fragments, total mass 
and the average fragment mass. Sternberg [7] found that the 
formula held over the central part of the weight range but 
underpredicted the number of small pieces and overpredicted 
the number of large pieces. This shortcoming was addressed 
by dividing the fragment field into three regions based on 
debris mass, each with its own formula for predicting the mass 
distribution. The average mass of the fragments is used as the 
independent parameter for all the formulas. Mass is 
conserved. The Sternberg model is used to predict the mass 
distribution of the launch vehicle debris field. 

The magnitude of the imparted velocity on a piece of 
debris is dependent upon the failure mechanism. For a CBM 
explosion, the imparted velocities are computed using CTH 
[8], a shock physics code. The volume of space available for 
propellant mixing and the amount and type of propellant are 
used to determine the amount of TNT that would result in the 
equivalent energy release [1,2]. The TNT material is placed in 
a model of the launch vehicle containing a representation of 
the tanks and walls. The Johnson-Cook fracture model and 
the Grady-Kipp fragmentation model are used to compute the 
fragmentation of the tanks and walls. The resulting CTH 
solution provides an imparted velocity profile as a function of 
axial location along the launch vehicle and an estimation of 
the relative number and size of the debris pieces. For 
imparted velocities due to an FTS event, the model developed 
by Hinckley et al. [5] is used. In this model, the linear shaped 
charge (LSC) is assumed to cut the propellant tank walls, 
allowing the propellant to vent due to internal pressure. 
Additional failure of the tank structure occurs due to stress 
concentrations in the cracks, creating debris pieces. The 
pieces are carried by the venting propellant, reaching 
maximum velocities based on the initial tank pressure and 
expected size of the holes. A similar approach is used to 
determine the imparted velocities due to a loss-of-control 
failure. In this case, structural failure due to aerodynamic 
loads lead to tank ruptures. These ruptures are expected to be 
larger than the initial cracks and holes created by the FTS 
event. 

3 DEBRIS CATALOGS 

The debris catalog model was used to create a catalog for 
the Space Shuttle external tank for comparison with the 
catalog developed by Hinckley et al. [6]. The average mass 
per debris piece was obtained from the Hinckley catalog. A 
comparison of the sorted debris mass distribution is shown in 
Figure 3. The catalog model predicted 17% fewer pieces than 
the Hinckley model and generally predicted larger pieces than 
the Hinckley model. The imparted velocity of each piece, as a 
function of the piece ballistic coefficient, is plotted in Figure 
4. The model does not account for the copper sheathing of the 
LSC, which is the group of small, high speed (-800 m/sec) 
pieces in the Hinckley data. Otherwise, the imparted 



velocities compared well. The catalog model predicted a system is able to generate enough separation distance between 
wider range of ballistic coefficients, but the values compared the crew module and launch vehicle that the debris strike 
well with the Hinckley data. probability is near zero. 



Figure 3. Comparison of debris mass distribution for 
Shuttle external tank 
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Figure 4. Comparison of imparted velocity for Shuttle 
external tank 

From a risk perspective, the relevant measure is the 
probability of debris striking the crew module during an ascent 
abort. The strike probability is computed using the model 
described in References 7 and 8. Using a generic ascent 
trajectory and an MPCV-based crew module and launch abort 
system, the strike probabilities for aborts at various mission 
elapsed times (METs) are shown in Figure 5. Both catalogs 
produced similar strike probabilities. With zero warning time, 
the crew module is still on the launch vehicle at the time of 
destruct, resulting in a debris strike probability near 1.0. As 
the warning time increases, the debris strike probability 
decreases. With one second of warning time, the launch abort 
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Figure 5. Debris strike probabilities of Shuttle external 
tank 

Sensitivity studies were conducted to determine the effect 
of debris catalog parameters on the debris strike probability. 
Parameters of particular interest were the number of debris 
pieces and the imparted velocities. Within the debris catalog 
generation model, the number of pieces was controlled by the 
average mass, Mbar , of the debris pieces. Increasing the 
average mass decreased the number of pieces and vice versa, 
as shown in Figure 6. The Shuttle external tank debris field 
discussed above was used as the baseline. The effect of the 
number of pieces on the debris strike probabilities for aborts 
with 0.5 sec warning time is shown in Figure 7. Debris strike 
probability exhibited a strong dependence on the number of 
debris pieces, with a reduction in risk corresponding to a 
reduction in the number of pieces. 



Figure 6. Debris mass distribution as function of Mbar 
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Figure 7. Effect of number of debris pieces on debris 
strike probability 

Another parameter of interest was the imparted velocity 
on the debris. A failure involving an CBM explosion will 
generate debris with high imparted velocities near the center 
of the explosion. The size of the explosion will also impact 
the imparted velocities. Explosions resulting from larger 
equivalent TNT yields will create higher imparted velocities 
than explosions using smaller equivalent TNT yields. In the 
model, the imparted velocities from TNT explosions are 
computed using CTH. A representative axisymmetric CTH 
model of the Shuttle external tank geometry with a TNT 


charge located in the intertank region is shown in Figure 8(a). 
A snapshot of the solution 0.01 sec after detonation is shown 
in Figure 8(b). The imparted velocities as a function of axial 
location on the launch vehicle were obtained from the CTH 
solutions. The resulting maximum imparted velocity 
distributions due to explosions of various sizes, together with 
the velocity distribution from the FTS destruct failure 
mechanism, denoted as the baseline curve, are shown in 
Figure 9. The small explosive charge yielded a localized 
increase in velocity near the explosion center. As the 
explosive charge increased in size, the imparted velocities 
increased and affected a wider region of the launch vehicle. 
The velocity data are used in the debris catalog generation 
model to determine the imparted velocities of each debris 
piece in the Shuttle external tank debris field. The effect of 
velocity on debris strike probability for aborts with 0.5 sec 
warning time is shown in Figure 10. In this case, the imparted 
velocities had little effect on the debris strike probabilities. 
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Figure 8. CTH model of geometry with TNT charge in 
intertank region 
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Figure 9. Imparted velocity as a function of axial 
location and size of TNT charge. 
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Figure 10. Effect of imparted velocity on strike 
probability 

The debris catalog generation model presented in this 
paper is a physics-based tool developed for use in the 
engineering risk assessments of launch abort system for 
manned launch systems. Such risk assessments are conducted 
early in the design cycle, requiring a tool that can create debris 
catalogs based only on preliminary design information. The 
tool must also be able to account for the effects the failure 
mechanism has on the debris characteristics. To meet these 
requirements, the model uses an explosion-based model to 
predict the number of pieces and solutions from a shock- 
physics code to predict the imparted velocity distribution for 
failure mechanisms involving explosions. Imparted velocities 
due to venting of pressurized propellants are also modeled. 


The resulting debris catalog defines the number of debris 
pieces and the mass, size and imparted velocity of each piece. 
The debris catalogs are then used as input into a risk model 
used to predict the probability of the crew module being struck 
by at least one piece of debris during an ascent abort. The 
results of the model show good agreement with an existing 
debris catalog for the Shuttle external tank. Sensitivity 
analysis using the model indicate that strike probability is a 
strong function of the number of pieces in the debris catalog 
and a relatively weak function of the imparted velocity. The 
model provides additional capability to the Ames Engineering 
Risk Assessment tool set used to assess risks associated with 
manned space flight systems. 
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